@checkstack/healthcheck-ping-backend 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @checkstack/healthcheck-ping-backend
 
+## 0.2.2
+
+### Patch Changes
+
+- 0ebbe56: Security Vulnerability Remediation completed:
+  - Refactored core authorization to Fail-Closed architecture with secure defaults.
+  - Implemented `assertTeamManagementAccess` to resolve BOLA in Teams Management.
+  - Protected internal S2S capabilities via explicit wildcard `serviceScope` definitions.
+  - Disarmed OS Command Injection in DiskCollector via strict regex validation and bash escaping.
+  - Re-architected inline script processing executing scripts in sandboxed Web Worker contexts.
+  - Isolated subprocess environment scopes in PingStrategy limiting variable leakage.
+  - Enforced strict token/API Key parsing with URLSearchParams checking.
+  - Explicitly fail-fast on missing DATABASE_URL configuration across independent backend clusters.
+  - Activated strict HTTP Security Headers (HSTS, CSP, X-Frame-Options) across the API automatically.
+- Updated dependencies [0ebbe56]
+  - @checkstack/backend-api@0.8.1
+  - @checkstack/common@0.6.3
+  - @checkstack/healthcheck-common@0.8.3
+
 ## 0.2.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-ping-backend",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "type": "module",
   "main": "src/index.ts",
   "scripts": {
@@ -9,7 +9,7 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.7.0",
+    "@checkstack/backend-api": "0.8.0",
     "@checkstack/common": "0.6.2",
     "@checkstack/healthcheck-common": "0.8.2"
   },

package/src/strategy.test.ts

@@ -202,4 +202,51 @@ describe("PingHealthCheckStrategy", () => {
       expect(aggregated.errorCount.count).toBe(1);
     });
   });
+  describe("Environment Isolation", () => {
+    it("should pass explicit env to Bun.spawn with only PATH, HOME, and LANG", async () => {
+      let spawnOptions: any = null;
+      Bun.spawn = mock((options) => {
+        spawnOptions = options;
+        throw new Error("Command not found");
+      });
+
+      const connectedClient = await strategy.createClient({ timeout: 5000 });
+      await connectedClient.client.exec({
+        host: "8.8.8.8",
+        count: 3,
+        timeout: 5000,
+      });
+
+      expect(spawnOptions).toBeDefined();
+      expect(spawnOptions.env).toBeDefined();
+      expect(spawnOptions.env.PATH).toBeDefined();
+      expect(spawnOptions.env.HOME).toBeDefined();
+      expect(spawnOptions.env.LANG).toBeDefined();
+      expect(spawnOptions.env.DATABASE_URL).toBeUndefined();
+
+      connectedClient.close();
+    });
+
+    it("should not leak parent process environment variables", async () => {
+      let spawnOptions: any = null;
+      Bun.spawn = mock((options) => {
+        spawnOptions = options;
+        throw new Error("Command not found");
+      });
+
+      process.env.SUPER_SECRET = "leaked";
+
+      const connectedClient = await strategy.createClient({ timeout: 5000 });
+      await connectedClient.client.exec({
+        host: "8.8.8.8",
+        count: 3,
+        timeout: 5000,
+      });
+
+      expect(spawnOptions.env.SUPER_SECRET).toBeUndefined();
+      delete process.env.SUPER_SECRET;
+
+      connectedClient.close();
+    });
+  });
 });

package/src/strategy.ts

@@ -215,6 +215,12 @@ export class PingHealthCheckStrategy implements HealthCheckStrategy<
         cmd: ["ping", ...args],
         stdout: "pipe",
         stderr: "pipe",
+        env: {
+          // SECURITY: Only pass necessary env vars to subprocess
+          PATH: process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin",
+          HOME: process.env.HOME ?? "/tmp",
+          LANG: process.env.LANG ?? "en_US.UTF-8",
+        },
       });
 
       const output = await new Response(proc.stdout).text();